Looking for Anomalies in Correlated Time Series

We present a proximity-based anomaly detection system designed to look for anomalies in multiple linearly correlated time series that can have trends. Our system is primarily designed to work in an unsupervised setting to detect contextual anomalies. Anomalies are data points whose values are considered extreme in relation to all other values observed at a particular point in time. Our system uses a two-step procedure to flag anomalous values. It first builds some representative time series, using simple descriptive statistics, of the underlying trend common to all time series in the data. Models are found for the representative time series in training sets with no anomalies. When the models are applied to test data, some days can be flagged as having anomalies. Then methods are used to find the anomalous values in the flagged days. The methodology is modified using robust measures of spread when there is no training set with no anomalies. The end result is a system that accurately classifies anomalies offline (in historical data sets) and is easy to and extend to detect anomalies online (in real-time).